alanj-alanj-mass_assignment_test_helper 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- data/README +39 -0
- data/lib/mass_assignment_test_helper.rb +44 -0
- metadata +55 -0
data/README
ADDED
@@ -0,0 +1,39 @@
|
|
1
|
+
mass_assignment_test_helper
|
2
|
+
===========================
|
3
|
+
|
4
|
+
This is a test helper that you can place into your test_helper.rb file to aid in testing your ActiveRecord models against mass assignment vulnerabilities.
|
5
|
+
|
6
|
+
The following form adds a method named test_mass_assignment_is_secure
|
7
|
+
to your class, so that mass assignment checks are a bit prettier:
|
8
|
+
|
9
|
+
test_mass_assignment_secure SomeModel, :first_name, :last_name
|
10
|
+
|
11
|
+
You can also just assert mass security in your test with:
|
12
|
+
|
13
|
+
assert_mass_assignment_secure SomeModel, :first_name, :last_name
|
14
|
+
|
15
|
+
In both instances the first argument is the name of the model that you want to test, and :first_name and :last_name fields are fields that are meant to be open to mass assignment.
|
16
|
+
|
17
|
+
License
|
18
|
+
=======
|
19
|
+
Copyright (c) 2008 Alan Johnson
|
20
|
+
|
21
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
22
|
+
a copy of this software and associated documentation files (the
|
23
|
+
"Software"), to deal in the Software without restriction, including
|
24
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
25
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
26
|
+
permit persons to whom the Software is furnished to do so, subject to
|
27
|
+
the following conditions:
|
28
|
+
|
29
|
+
The above copyright notice and this permission notice shall be
|
30
|
+
included in all copies or substantial portions of the Software.
|
31
|
+
|
32
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
33
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
34
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
35
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
36
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
37
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
38
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
39
|
+
|
@@ -0,0 +1,44 @@
|
|
1
|
+
class Test::Unit::TestCase
|
2
|
+
|
3
|
+
# asserts that mass assignment is secure on an object
|
4
|
+
def assert_mass_assignment_secure(model, *skip)
|
5
|
+
|
6
|
+
# construct a new instance of the model
|
7
|
+
obj = model.new()
|
8
|
+
|
9
|
+
# loop through and set a value for each item
|
10
|
+
test_hash = {}
|
11
|
+
attributes = obj.attributes
|
12
|
+
attributes[:id] = obj.id
|
13
|
+
attributes.each do |attribute, value|
|
14
|
+
test_hash[attribute] = rand(10000000000).to_s + Time.now.to_i.to_s
|
15
|
+
end
|
16
|
+
|
17
|
+
# mass assign the test hash
|
18
|
+
obj.attributes = test_hash
|
19
|
+
|
20
|
+
# see what items stuck
|
21
|
+
failures = []
|
22
|
+
attributes = obj.attributes_before_type_cast
|
23
|
+
attributes[:id] = obj.id_before_type_cast
|
24
|
+
attributes.each do |attribute, value|
|
25
|
+
if value == test_hash[attribute] && !skip.include?(attribute) &&
|
26
|
+
!skip.include?(attribute.to_sym)
|
27
|
+
failures << attribute
|
28
|
+
end
|
29
|
+
end
|
30
|
+
|
31
|
+
# raise the assertion failure
|
32
|
+
if failures.length > 0
|
33
|
+
flunk "Attributes [#{failures.join(",")}] are not secure."
|
34
|
+
end
|
35
|
+
end
|
36
|
+
|
37
|
+
# defines a new test method on the test class for checking models with
|
38
|
+
# less code
|
39
|
+
def self.test_mass_assignment_secure(model_class, *skip)
|
40
|
+
define_method(:test_mass_assignment_is_secure) do
|
41
|
+
assert_mass_assignment_secure(model_class, *skip)
|
42
|
+
end
|
43
|
+
end
|
44
|
+
end
|
metadata
ADDED
@@ -0,0 +1,55 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: alanj-alanj-mass_assignment_test_helper
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.0.1
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Alan Johnson
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
|
12
|
+
date: 2008-05-23 00:00:00 -07:00
|
13
|
+
default_executable:
|
14
|
+
dependencies: []
|
15
|
+
|
16
|
+
description: Mass Assignment Test Helper helps you test your activerecord models for mass assignment vulnerabilities.
|
17
|
+
email: alan@gnoso.com
|
18
|
+
executables: []
|
19
|
+
|
20
|
+
extensions: []
|
21
|
+
|
22
|
+
extra_rdoc_files:
|
23
|
+
- README
|
24
|
+
files:
|
25
|
+
- README
|
26
|
+
- lib/mass_assignment_test_helper.rb
|
27
|
+
has_rdoc: true
|
28
|
+
homepage: http://github.com/alanj/mass_assignment_test_helper
|
29
|
+
post_install_message:
|
30
|
+
rdoc_options:
|
31
|
+
- --main
|
32
|
+
- README
|
33
|
+
require_paths:
|
34
|
+
- lib
|
35
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
36
|
+
requirements:
|
37
|
+
- - ">="
|
38
|
+
- !ruby/object:Gem::Version
|
39
|
+
version: "0"
|
40
|
+
version:
|
41
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
42
|
+
requirements:
|
43
|
+
- - ">="
|
44
|
+
- !ruby/object:Gem::Version
|
45
|
+
version: "0"
|
46
|
+
version:
|
47
|
+
requirements: []
|
48
|
+
|
49
|
+
rubyforge_project:
|
50
|
+
rubygems_version: 1.0.1
|
51
|
+
signing_key:
|
52
|
+
specification_version: 2
|
53
|
+
summary: Helper for testing mass assignment security.
|
54
|
+
test_files: []
|
55
|
+
|